It was a sickening, gut-wrenching moment when, one evening in October 2012, Sally Donaldson checked her bank account and realised she had made the silliest financial mistake of her life.

Two years earlier, hairdresser Sally had organised for her monthly pay, £1,000, to be transferred from her HSBC account to the joint account at Nationwide building society she shares with her husband. But on that October night, the mother of two discovered she had made a simple but calamitous error.

It's a mistake anyone can make. To transfer money online from one account to another, you simply tap in the recipient's name, their sort code and account number. But Sally had incorrectly typed in just one of the eight digits in the account number – and the money was sent to the wrong person.

What makes her story so extraordinary, though, is that she made the mistake in May 2010. Every month since – for more than two years – her pay was going into someone else's Nationwide account. And now, to her horror, Sally is discovering she has almost no chance of getting back a penny of the £26,650 transferred in error.

The recipient took the money, spent it, and is refusing to repay it. Nationwide says there is nothing it can do – and won't tell Sally who the recipient is because of data protection rules.

The fact she correctly entered her surname as the intended recipient at Nationwide, alongside the correct sort code, counted for nothing. When banks transfer money, they use only the sort code and account number – it turns out that account names are irrelevant.

Legally, Sally has every right to demand the money back – no one is entitled to keep money wrongly credited to their account. But getting it back is an altogether different matter.

Many people will sympathise with her over a silly mistake. But most will also wonder how she and her husband failed to notice a missing £1,000 every month. Indeed, Nationwide says it has never before come across a case of "mis-applied credit" that went on for so long.

The answer may lie in the widespread switch to paperless statements, where an account can only be viewed online. Sally did not see a bank statement from Nationwide for the entire period the money was going astray. She kept an eye on the balance when she took money out at the ATM, but that was about all, while her husband, who also paid his income into the account, sorted out most of the bills.

"By law, a person is not entitled to rely on another's mistake to keep money to which they were not entitled," a Nationwide spokesman says. But he adds: "The final payment transferred was recovered, but previous payments were no longer in the account. The recipient has been contacted and we have established she doesn't have the funds to repay."

This is one of those rare situations that a person should have the ability to sue the way we do in the USA. Refusing to pay it back should be illegal. There is no way the recipient didn't know that money didn't belong to them.

The recipient probably justified spending the money as it was the bank's error. However, this story puts a name and story to that windfall. In the end it's not the "cold-hearted bank" that was hurt, but someone innocent who made a mistake. Although we don't know the recipient's circumstances, they shouldn't have spent money that wasn't theirs.

I don't understand how it went unnoticed for so long. You'd think a normal person would check their monthly back statements at least once in that time period.

It is unusual. The only thing I can think is that they were so focussed on saving that they just didn't want to check their account. I don't know, it's a sad story, especially when you read on and see that their joint income is less than £50,000.

The banks should improve the way they handle online transactions. She was asked for a surname in addition to the account and sort code and it's reasonable to expect that the surname was used to validate the account details. If not, why did the bank ask for it? Also, why don't bank accounts incorporate a check digit to avoid this sort of thing?

The recipient probably justified spending the money as it was the bank's error. However, this story puts a name and story to that windfall. In the end it's not the "cold-hearted bank" that was hurt, but someone innocent who made a mistake. Although we don't know the recipient's circumstances, they shouldn't have spent money that wasn't theirs.

As the article states, the recipient wasn't legally entitled to spend the money. They're only getting away with it because the bank isn't prepared to recoup the money from them.